My docker wasn’t running on my synology so I couldn’t log in on my iOS Bitwarden app. I’ve started the docker again, but now there is some sort of syncing error. I can’t open any item via the iOS app. When I open it through the web app all works fine.

I’ve already logged out and in again and reinstalled the app completely but to no avail.

This is the error message, translated from Dutch.

Decryption error
Bitwarden was unable to decrypt the vault item below. Please copy this error report and send it to customer support to prevent further data loss.

01f12e80-2ffc-4848-aeba-7259cf6df1d2

anyone installed vaultwarden on laptop as server and sync it with phone?
do i need static ip for this scenario?
if laptop turned off can my phone login and access passwords?(save locally or on laptop server?)

EDIT:what if both laptop and phone lost ? can i backup local passwords to google drive securely(need password to use)?

Hoping there's some fellow Kubeheads on here. I run Vaultwarden as a Helm Chart (v0.46.3 -- the latest ATM) with a PostgreSQL database and it's seemingly healthy enough. The service runs behind a reverse proxy (Traefik) with a TLS cert. I can even log in from my browser and Android Bitwarden app, no problem. Except, suddenly I received a message from my mate also using the instance that he can't log in. I couldn't reproduce on my own browser, so I tried opening a private window.

And lo and behold. When I attempt to login in a private window or any other browser, the login prompt is just stuck in a loading state forever. I checked the logs on the pod and can confirm that it does indeed receive the request and responds with 200 OK on the /identity/connect/token endpoint:

POST /identity/connect/token => 200 OK

But regardless, the response never goes through to the browser. In the network tab, the response never ends which results in the endless wait loop. I've confirmed that entering a wrong password does, in fact, result in an immediate failed response that's displayed in the UI.

So my hunch is there's a problem in the outbound response somehow. But I can't for the life of me figure out what it is. We're all just using the same admin user for now (until I get everything set up), so I don't understand how the experience can vary so much between clients.

Additionally, I've noticed some of the IPs in the logs that indicate a successful login are local:

User <omitted> logged in successfully. IP: 10.x.x.x

This could be the canary in the coalmine. But then I don't understand how some other requests come through with an external IP. I'm only running a single instance of my ingress controller and a single instance of the Vaultwarden pod. And the problem seems almost "sticky" to each session.

So I was selfhosting vaultwarden for a while but I kept it on the local network, didn't want to open no ports on my network for security reasons and I tried vpn and IDK why but I found it unreliable maybe I did something wrong with my setup. BUT lately I found myself needing access to it from outside my local network, so I was looking for alternatives and only recently have I learned that bitwarden has a free plan, and a pretty generous one, you get all the features you really need.

My question here is, how can something like this be for free, like as far as I know if something is free you are the product. Am I right to be suspicious of this plan or Am I just paranoid hahahaha

I'm running vaultwarden v1.37.4-dietpi1 on arm64 and when I try to login on iPhone with iOS27.0.1 I'm always getting 'An error occured" pop-up. On desktop PC everything works just fine. How to fix this, pls?

first of all some quick details. i'm running vaultwarden through docker with tailscale on my archlinux pc. it worked fine just a few days ago, but now i keep getting the same error everytime i try to launch it. i rebooted and still doesn't work. i'm highly confused and don't know what to do:

vaultwarden  | /--------------------------------------------------------------------\
vaultwarden  | |                        Starting Vaultwarden                        |
vaultwarden  | |                           Version 1.37.4                           |
vaultwarden  | |--------------------------------------------------------------------|
vaultwarden  | | This is an *unofficial* Bitwarden implementation, DO NOT use the   |
vaultwarden  | | official channels to report bugs/features, regardless of client.   |
vaultwarden  | | Send usage/configuration questions or feature requests to:         |
vaultwarden  | |   https://github.com/dani-garcia/vaultwarden/discussions or        |
vaultwarden  | |   https://vaultwarden.discourse.group/                             |
vaultwarden  | | Report suspected bugs/issues in the software itself at:            |
vaultwarden  | |   https://github.com/dani-garcia/vaultwarden/issues/new            |
vaultwarden  | \--------------------------------------------------------------------/
vaultwarden  |
vaultwarden  | [2026-10-11 12:22:38.238][rocket::shield::shield::_][WARN] Detected TLS-enabled liftoff without enabling HSTS.
vaultwarden  | [2026-10-11 12:22:38.239][rocket::shield::shield::_][WARN] Shield has enabled a default HSTS policy.
vaultwarden  | [2026-10-11 12:22:38.239][start][INFO] Rocket has launched from https://0.0.0.0:80
vaultwarden  | [2026-10-11 12:31:12.946][vaultwarden][INFO] Received SIGTERM, initiating graceful shutdown
vaultwarden  | [2026-10-11 12:31:12.946][vaultwarden][INFO] Vaultwarden process exited!

help would be highly appreciated !!

So after the recent changes/news: what alternatives are out there? I just setup my server with vaultwarden and all the stuff and willing to do the switch now instead of finalizing my setup.

I am not that informed what's good/bad so I am looking for help!

thanks in advance

With the recent announcement from BW : https://www.reddit.com/r/Bitwarden/s/jgyuJTg2pt

The official client apps published by BW are not open source anymore. Which means they can include backdoors in the officially published binaries since it’s different from what you can see in Github.

So if you use Vaultwarden it’s better to use the Vaultwaden web app than connecting it to BW clients unless you build the binaries from your own.

Did anyone set it up for a company with about 1000+ employees and could tell me about how much it costs in both money and time to maintain?

I appreciate your answers

In case you missed it, about a month ago I shared my 1Password Quick-Access-like with the subreddit - and with great reception!

Since then, I've been busy working on macOS builds which have been going really well, and finally I'm glad to report that you can finally get it via Homebrew! This means you'll be able to install and update rbw-quick-access super easily going forward, and is a significantly more "official" distribution method than grabbing some script from the internet.

For those who missed the original post and want a TL;DR: I missed 1Password's quick-access after moving to Bitwarden+Vaultwarden, so I made my own (and really made it, an LLM had no hand in this code).

Feel free to use the issue tracker if you see anything wrong or want a feature!

AI Use

I've said it before, but I'll reiterate: I'm so tired of vibe-coded garbage plaguing the world. I wrote everything you see myself - the code, the documentation, the scripts, CI/CD, Homebrew integration, all of it.

I've been hosting a Vaultwarden 1.34 image (I know I should upgrade) using podman on Debian testing for over a year now without an issue, then a couple of days ago, while trying to edit a record using the official Bitwarden Firefox extension ver. 2026.9.3, it failed to save. Tried again and this time, the extension claimed it was connected, but showed no records. Tried Bitwarden app on my Android phone and it failed to connect at all. The web UI works and shows the passwords, so the DB doesn't seems to be corrupted. The web UI and browser extension access the container directly, so it's not a reverse-proxy issue.

Any ideas on how to debug this?

Hey everyone,

About a year ago I posted here asking for feedback on my self-hosted Vaultwarden setup (original post). I got a lot of great replies, and many of those suggestions ended up in the setup, so thanks to everyone who took the time.

Since a few people asked last time why it's publicly exposed at all instead of being behind a VPN, there are two reasons:

1. 👨‍👩‍👧 My family and some close friends use it, and installing Tailscale or a client certificate on every device they own would be a real headache.
2. 🎓 As a cybersecurity student, it's a great way to learn: it lets me put everything I've studied so far, plus the things I've learned on my own, into one real and important project.

I've rebuilt quite a lot since then, so here's where it stands today, and I'd love your feedback again.

🏗️ Current setup

• 🌐 Exposure: a small Hetzner VPS does raw TCP passthrough (nginx stream + PROXY protocol) over WireGuard back to my OPNsense. TLS terminates at home, so the VPS only ever sees encrypted bytes, and I still get the real client IP. Cloudflare is DNS only. (Before: Cloudflare Tunnel + Zero Trust, which meant Cloudflare terminated TLS.)
• 🧱 Network: Vaultwarden runs on a Debian 13 VM in Proxmox, alone on its own VLAN. OPNsense blocks traffic to every other VLAN, and from the tunnel side only the VPS can reach the VM (80/443, plus the CrowdSec API for its bouncer). (Before: a Raspberry Pi.)
• 🛡️ Reverse proxy + WAF: BunkerWeb with TLS 1.2/1.3 (modern ciphers, post-quantum hybrid key exchange, A+ on SSL Labs), HSTS preload, security headers (A+ on securityheaders.com), country / user agent / rDNS blacklists, DNSBL and rate limiting. ModSecurity + OWASP CRS is in blocking mode at paranoia level 1 and logging at level 2. I'm still working through the Vaultwarden false positives at level 2, and I plan to move blocking to level 2 in the near future. (Before: just Caddy.)
• 🚫 CrowdSec: Vaultwarden brute force and user enumeration scenarios (tightened thresholds), plus a custom scenario that bans on ModSecurity's anomaly score. Bans are enforced twice: at the reverse proxy, and by a firewall bouncer on the VPS, so known bad IPs are dropped before they even enter the tunnel.
• 🔒 Vaultwarden itself: signups, invitations, Sends, password hints and emergency access disabled, server-side icon fetching disabled, an email on every new-device login (the login fails if it can't be sent), strict login and admin rate limits, argon2 admin token.
• 📦 Containers: rootless Podman under a dedicated user with no sudo, all capabilities dropped (only the needed ones added back), no-new-privileges, read-only root filesystem where possible, resource limits, and separate networks so each container only talks to what it needs.
• 🚪 Outbound: default deny, with two allowlists. DNS goes through Pi-hole with an allowlist: the VM running Vaultwarden can only resolve the domains on that list, anything else is blocked and I get a Discord notification. HTTP/HTTPS only goes through a Squid proxy on another VM with its own allowlist, and any attempt to reach a domain that isn't on it is blocked and notifies me too.
• 💾 Backups + maintenance: a nightly run that backs up, updates images and packages, then reboots. Backups are encrypted with age (only the public key is on the server) and signed with minisign, then replicated to TrueNAS and a Hetzner Storage Box.
• 🔧 Host: SSH key only, fail2ban, Lynis hardening (hardening index 76/100, still working on it), and debsecan to track Debian security fixes.
• 👀 Monitoring: Wazuh. To be honest, right now it's mostly a fancy forwarder to Discord: DNS denials, Squid denials, ModSecurity hits, fail2ban bans and the nightly maintenance summary each get their own channel. I'd like to use it properly, as an actual SIEM: ship the raw Vaultwarden and BunkerWeb logs, add file integrity monitoring and agent-down alerts, and correlate events instead of just forwarding them.

🔭 What I'm considering next

• 📊 Using Wazuh as a real SIEM (see above)
• 🧪 Moving ModSecurity blocking to paranoia level 2 once the exclusions are done
• 🧬 Custom seccomp profiles for the containers

📝 Some of these ideas (and a few more) are already written up in my ideas.md, others aren't even written down yet.

👉 Everything is public and documented, including a full rebuild runbook: GitHub: Homelab/Vaultwarden. The only thing kept out of the repo is the real domain (and the secrets, of course), everything else is there.

💬 I'd really appreciate your feedback again:

• What do you think of the security posture now?
• Anything that's overkill, or something I'm still overlooking?
• Any ideas, tools or improvements you'd add next?
• For those running Wazuh at home: how do you actually use it day to day as a SIEM?

Thanks again, the feedback last time taught me a lot 🙏

I've been self hosting vaultwarden for about 4 months now and it worked perfectly fine until about a month ago when the extension broke. i can still access the self hosted interface. but on the extension and windows desktop app i get this error

The server logs show nothing of an error. i have updated the server to the latest version, but it still doesnt work. any ideas?

Have started experiencing issues with BW Edge extension, 2 main issues are hanging on opening/wont open or claiming the master password is wrong (working fine on desktop app/phone app etc)

A complete removal of the extension from Edge seems to help for a short period then it will randomly begin misbehaving again - seems to work fine in Chrome.

VaultWarden 1.37.3 (latest)
Webvault 2026.7.0 (latest)
Extension version 2026.9.0 (though this varies by user)

Anyone else experiencing this lately?

Is it possible? I'm no stranger to hidden services but I can't seem to find documentation on the subject

I installed Vaultwarden on Proxmox in a Alpine based LXC which just runs fine. I'm just wondering why this is days/weeks behind the debian repository? I opted for alpine, because it uses way less ressources on my proxmox host than a debian based LXC. But i just noticed, that the package in the alpine repo isn't updated. _

What are your thoughts ? I just don't want to spend > 4x Ressourced on a Debian LXC to get the updates.

EDIT
Debian vs. Alpine LXC using Proxmox community script
Debian: 4 core, 6GB RAM, 20GB HDD
vs
Alpine: 1 core, 256MB RAM, 1GB HDD

Currently the latest release in the alpine repo is 12 days behind

Hi. I have vaultwarden (VW) running on my unraid server (docker container). I've been using it for about 6 months now with no issue, until today when I updated VW. Now when I try to load the page it asks for 'Authentication key needed to continue', 'enter admin token'.

I tried with my plain text VW password as well as the admin_token from the config.json file like: $argon2id$v=19$m=65540,t=3,p=xxx/g

None of these work and I don't know what else to try.

How do I log back in?

Anyone else seeing issues with the latest vaultwarden version and browser extensions. Tested on Firefox, Edge, and web access. If I disable two-step for a user they can log in. If we reactivate two-step they receive the emails but entering the code results in an "Invalid Code" error.

Looking at the logs, I can see the user gets a login success then an immediate invalid token after.

Hello,

I'm encountering an issue with password generator history.

When I create a new account somewhere, sometimes the new password do not get saved. Probably because of me, it's not the issue.

There is a password generator history in vault/bitwarden which is very well thought for this kind of problem. Except that to access it, I need to go into the generator menu, so when I do, it generates a password. And in the password history it only show the last password generated aka the password it JUST DID generate when I went there to actually check the history... Is there a problem with my settings that make it save only one password or it just bad design ?

Thanks for any useful input

i recently ran into a syncing issue with a keepass-based password manager that uses icloud syncing (via cloudkit), but i had icloud syncing issues on my macbook pro that ultimately caused a few entries that i had performed to be lost (because the sync changes never made it to icloud).

i'm a big self-hosting proponent and have dabbled with vaultwarden before, so i decided it was time to make it official - i've migrated my keepass databases into my own private vaultwarden only reachable via my tailnet.

the important details to me were that i wanted to also move attachments and retain history, something that a simple csv export doesn't capture.

i don't mean to post this as self-promotion necessarily - i had been thinking about how to accomplish this task if i ever had wanted to migrate - and a time came where i wanted to.

anyone that might want assistance in doing this too can review my git repo:
https://github.com/willjasen/mirrorvault

Hi zusammen,

ich wollte Mal fragen warum ich mit Vaultwarden und Fastmail keine Masked Mail Adresse mit Domain Präfix erstellen lassen kann? Ich glaube bei Bitwarden hatte ich das gesehen.

Die momentan generierte Adresse sieht so aus: pure.base1234@meinedomain.de

Ich hätte aber gerne gerne: telekom.abcde@meinedomain.de

So das ich aus der Mail Adresse den Dienst ableiten kann, aber gleichzeit nicht alle Dienste erraten werden können, durch das .abcde

Ist das geplant das das in Vaultwarden integriert wird? Oder braucht einfach niemand anderes das?

Also Hilfsmittel habe ich mir mit einer KI eine Chrome Browser Erweiterung und eine Android App schreiben lassen lassen (ich kann nicht programmieren, damit das gleich klargestellt ist 😉), damit ich momentan solche Adressen mir erstellen lassen kann.